Data processing agreement

1. Roles of the parties

The client, the organisation that uses the Service, is the controller of the personal data contained in what its team entrusts to the Service: the content of the conversations and the files attached to them, what the assistant reads in the connected cloud accounts, the library of questions, the approvals and the journal of the changes. Move2Cloud processes them as processor, on the client's behalf.

For the data it needs for its own purposes (the accounts of the users and their sign-in, the security of the Service, invoicing, support and the relationship with the client), Move2Cloud is the controller; the privacy policy describes them.

2. Instructions

Move2Cloud processes the personal data only on the documented instructions of the client: the terms of use, this agreement, and the choices the client makes in the Service (the cloud accounts it connects, the changes it confirms, the retention periods it sets). It processes them for no other purpose, sells nothing of them and uses them to train no model. If an instruction seems to it to infringe the law on data protection, it tells the client.

3. Confidentiality

The people of Move2Cloud authorised to process the data are bound by confidentiality. The administration of the platform shows neither the credentials of the cloud accounts nor the content of the conversations.

4. Security

Move2Cloud implements the technical and organisational measures described in section 7 of the privacy policy, among which encrypted exchanges, the credentials of the cloud accounts encrypted in the database, two-factor authentication required for every user, the partitioning of the data by user and by organisation, and hosting in France.

5. Sub-processors

The client gives Move2Cloud a general authorisation to use the following sub-processors, described in section 5 of the privacy policy:

• Scalingo (France): hosting of the Service, of its databases and of their backups, and of the identity service.
• Scaleway (France): storage of the attached files and of the exports, and sending of the e-mails.
• Automated processing providers (European Union or United States, as stated in section 6): producing the answers of the assistant; their identity is given to the client on request, at contact@move2cloud.fr.

The payment and invoicing providers named in the privacy policy (Mollie, Qonto) are not sub-processors under this agreement: they process the invoicing data of Move2Cloud, of which Move2Cloud is the controller. Nor are Google and Microsoft, which only the people who choose to sign in with them use.

Move2Cloud binds each sub-processor by contract to obligations of data protection equivalent to those of this agreement, and remains liable to the client for them. Before adding or replacing a sub-processor, it informs the owner of the organisation at least 10 days in advance, by e-mail and in the notifications. Within that time, the client may object for a reason related to data protection; failing an agreement, it can cancel its subscription without the month's notice.

6. Transfers outside the European Union

The Service and its data are hosted in France. Only the answers of the assistant may be produced in the United States, for the conversations on AWS or Microsoft Azure and those without a cloud account. These transfers are governed by the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), incorporated into the data processing agreement of each provider concerned.

7. Rights of individuals

The Service lets the client answer most requests itself: each member downloads their data and deletes their account from the console, and the administrators manage the team, the cloud accounts and the journal. If Move2Cloud receives a request directly, it passes it on to the client without answering it, and helps the client answer it within the time the law allows.

8. Personal data breaches

Move2Cloud informs the owner of the organisation of any personal data breach concerning its data without undue delay, and within 48 hours of becoming aware of it, with what it knows of its nature, of the data and people concerned, of its likely consequences and of the measures taken. It then helps the client meet its own obligations of notification.

9. Assistance

On request, Move2Cloud gives the client the information it holds to carry out a data protection impact assessment, or a prior consultation of the supervisory authority.

10. Audits

On written request, once a year, Move2Cloud gives the client the documents needed to show that it complies with this agreement. If they are not enough, the client may have an audit carried out once a year, at its own cost, by an independent auditor bound by confidentiality and not a competitor of Move2Cloud, after at least 30 days' notice, during working hours and without disrupting the Service.

11. End of the processing

When the organisation is deleted, its data is deleted from the Service, within the periods stated in section 6 of the privacy policy; deleted data may remain in the backups of the host until they expire. Before that, the client can download its conversations and export its journal from the console. Invoices and the proof of SEPA direct debit mandates are kept for the time the law requires.

12. Duration and precedence

This agreement applies as long as Move2Cloud processes personal data for the client under the terms of use. In case of conflict with the terms of use, it prevails for what concerns the protection of personal data. The liability of each party is governed by the terms of use.

Annex: description of the processing

• Nature and purpose: providing the Service, that is answering the questions of the client's team about its cloud accounts, preparing and running the changes it confirms, and keeping its conversations, its library of questions and its journal.
• Data subjects: the members of the client's team, and any person whose personal data appears in the conversations, the attached files or the connected cloud accounts.
• Categories of data: the account data of the members (name, e-mail address, role); the content of the conversations and of the attached files; what the assistant reads in the cloud accounts (names, configuration and state of resources, which may contain personal data); the library of questions, the approvals and the journal of the changes.
• Sensitive data: none is expected; the client avoids entrusting any to the Service.
• Frequency and duration: continuous, for as long as the client uses the Service, then until the deletion described in section 11.